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The continuous variable quantum key distribution is expected to provide high secret key rate 
without single photon source and detector, but the lack of the secure and effective key distillation 
method makes it unpractical. Here, we present a secure single-bit-reverse-reconciliation protocol 
combined with secret information concentration and post-selection, which can distill the secret 
key with high efficiency and low computational complexity. The simulation results show that this 
protocol can provide high secret key rate even when the transmission fiber is longer than f 50km, 
which may make the continuous variable scheme to outvie the single photon one. 



PACS numbers: 03.67.Dd, 42.50.-p, 89.70.+C 

Recently, many approaches for quantum key distribu- 
tion have been put forward, which may be divided into 
two major typeSjSingle photon one P, Q and continuous 

'[ variable one |S 0, U 0| ■ The former needs single pho- 
ton detector and single photon source or weak coherent 

' source 0, therefore the high secret key rate becomes a 
hot topic. Fortunately, the continuous variable quantum 

\ key distribution (CVQKD) is potentially to provide high 
secret key rate even for long transmission distance 
and only requires the coherent light source as well as the 
homodyne detection. Many experiments show the physi- 

\ cal possibility of this scheme However, unhke the 

single photon one, after the quantum transmission pro- 

\ cess, the CVQKD only provides continuously distributed 
raw key elements that should be converted into binary 
keys. Although its potential has been demonstrated, how 
to distill the secret key is still an open problem. Firstly, 

' some information will be certainly lost or leaked during 
the distillation. Secondly, if taking the concrete distilla- 

\ tion into account. Eve's attack may be much more sophis- 
ticated than that considered in Refs. I^^IHI^' When 
the channel loss is high, the maximum mutual informa- 
tion between Alice and Bob is only slightly higher than 
that between Eve and Bob, and it is possible that even 
if the CVQKD could be proved unconditionally secure, 
any secure binary key could not be distilled. 

The only existing reconciliation protocol was proposed 
by Assche et aZ 19], and used in current experimental 
demonstrations In the protocol, they subtly com- 
bined the quantization with error correction and tried 
the best to reduce publicly exchanged information. How- 
ever, it is effective only when the quantum channel loss 
is small 0, . In Ref. , the error correction block size 
for the reconciliation was selected as 50 000, which is al- 
ready very complex to implement, but only within 3.1 
dB loss, could a secret key be distilled. In fact, the basic 
assumption of the previous security proofs of CVQKD 
is perfect, i.e. an ideal reconciliation that can convert 
the continuous-clement into common bits without any 



auxiliary tactics. However, such reconciliation cannot be 
realized under the high loss condition because the error 
correction it demands will be too complex to implement 
pH l. Therefore, a feasible reconciliation is necessary to 
show the practical security of the CVQKD. 

In the following, we present a single-bit-reverse- 
reconciliation protocol to convert the element into com- 
mon bits, after which large portion of secret information 
can still be kept secret from Eve. We prove that Eve's 
attack is based on a Markov chain under the condition 
of no excess noise, and under the noisy condition. Eve's 
tapped additional information can be eliminated. Then 
we show this protocol to be secure, which is also a prac- 
tical security proof for the CVQKD. In this protocol we 
concentrate the secret information into certain bits, ex- 
pose other useless information and flexibly employ some 
tactics, such as post-selection, to keep Eve at a disadvan- 
tage, and then the computational complexity is largely 
reduced. With this protocol, 18% of the theoretical maxi- 
mum keys can be distilled at 100km transmission distance 
(O.GldB loss) and even at 150km transmission distance 
(O.OOldB loss) the secret keys can still be distilled. 

Here, we discuss the CVQKD scheme of reference 3, 
namely the Gaussian modulated coherent state scheme. 
Suppose Alice and Bob's x and p quadratures are Ax, 
Ap, _B2;and Bp respectively, Alice's modulation variance 
is VaNq, where A^o denotes the shot noise variance, and 
Alice, Bob and Eve's raw key elements are a, h and c 
respectively. In this scheme we require that Alice and 
Bob estimate the conditional entropy and distribution 
between them. Then the single-bit-reverse-reconciliation 
protocol runs as follows. 

1. Alice slices her raw key element space into regions, 
and denotes those regions with natural numbers in the 
order as shown in Fig^ The width of each region must 
be much smaller than the variance of Eve's and Bob's 
estimates of Alice's quadratures. 

2, Alice sorts her regions into pairs, making sure that 
each region belongs to only one pair. The distance be- 
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FIG. 1: An example of the pairing method, where identical 
colors have been used to denote the two parties of one pair. 



tween two parties of one pair is ba. For example, we can 
select pairs by combining 4 with -4, 1 with 8, 2 with 9, 
. . . , m with m+7, and so on. 

3. Alice converts her key elements into binary bits 
according to whether they belong to the left or the right 
regions of their pairs. If a certain element belongs to the 
left region of one pair, Alice designates it as 0, and if 
to the right hand side, as 1. Then she tells Bob which 
pair each of her raw key elements belongs to, but without 
exposing her designated bit results. For example, if one 
of Alice's key elements belongs to region 2 or 9, then she 
sends the pairing sign 2-9 to Bob, and assigns it as or 
1 correspondingly. The slicing, sorting and assignment 
methods are publicly known. 

4. According to Alice's pairing sign and his own re- 
sults, Bob calculates the conditional probabilities P(0|6), 
P(l|&) [3| and the bit error rate (BER) of each of his key 
elements, where and -P(0|6) denote the probability 
that Alice assigns her data as lor 0, while Bob's measure- 
ment is &. The BER actually is min[P(0|6),P(l|&)]. Then 
Bob divides his elements into or 1 according to which of 
P(0|&)and P{V\h) is bigger. What should be emphasized 
is that the channel may be binary asymmetric. 

5. After many such communications, Alice and Bob 
share a series of binary strings. Then Bob discards those 
bits with high BER and sorts remained bits into groups 
according to the BERs and pairing information to make 
it convenient for further error correction, privacy amplifi- 
cation and so on. For example, he sorts those bits of one 
pair with approximately identical BERs into one group. 
Later, Bob tells Alice which group each of her bits be- 
longs to. 

6. Bob sends the appropriate error correction informa- 
tion of each group to Alice. After error correction, Alice 
and Bob share a series of common binary strings. Then 
through privacy amplification , they thus finally have 
a common secret key. 

In the coherent state scheme, depending on Alice's 
quadratures and Eve's attack, the entropy of Bob's 
measurement satisfies 0: il(Bx\Ex) -f li(Bp\A^) > 



2Ho, where represents the tapped result of Eve, 
-ff (•|-)denotes the conditional entropy and Hq is the en- 
tropy of a quadrature of the vacuum state. Because Bob 
randomly chooses x ot p for his measurement, the se- 
cret key rate guaranteed by the reverse reconciliation is 
AI = I{A : B) - I{B : E) = H{B\E) - H{B\A), where 
/(•|-) denotes the mutual information. In the same way, 
we also have H{Bx\Ex,Ax) + H{Bp\Ap) > 2Ho. 

We will first discuss the case without excess noise 0. 
The states that Alice sends to Bob are coherent states, so 
that H{Bx\Ax) + H{Bp\Ap) = 2Hq. In the channel esti- 
mation, Alice and Bob should estimate the conditional 
entropy exactly, which means that any eavesdropping 
should maintaini? (_B|c, ^) = H{B\A). Then we obtain: 

AI ^ I{A: B\E) (1) 

From A/ = I {A : B) - I{B ; E) and Eq.© we have: 

H{B,E\A)^H{E\A) + H{B\A) (2) 

On the other hand, Alice sends Bob the coherent state 



I a), which is attenuated to |vGa) by the time it arrives 
at Bob when the channel transmission is G. Thereby, 
under the case of Gaussian modulation, the distributions 
of a and b can be written as: 
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The coherent state guarantees the conditional distribu- 
tion P{b\a) to be the distribution with the minimum shot 
noise, and since Eve cannot know which quadrature Bob 
will choose to measure, after many communications Al- 
ice and Bob can employ, for example, the normality test 
to limit Eve's tapped information. Any of her attacks 
should maintain the conditional distribution of Eq.Q), 
which means P{b\a) — P{b\a,c). 

We can then obtain P{b,c\a) = P{c\a)P{b\a, c) — 
P{c\a)P{b\a) and P{c,a\b) = P{c\a)P{b\a)P{a)/P{b) = 
P{c\a)P{a\b). 

Thus 



P{c\b) = j P{c\a)P{a\b)da 



P{b\c) 



P{b\a)P{a\c)da 



(5) 



(6) 



Eqs.lQJ 10) lO and © show that under the condition that 
Alice's quadratures are known, Bob's and Eve's measure- 
ments are independent. They also illustrate that, for re- 
verse CVQKD, if there is no excess noise, any eavesdrop- 
ping of Bob's information is equivalent to a Markov chain 
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of Eve Alice Bob, which means that for the reverse 
scheme, the information can be regarded as having been 
sent by Bob, received by Ahce, and then transmitted to 
Eve by AHce. All of Eve's information about Bob is ob- 
tained from Alice. To estimate Bob's result, at first Eve 
should estimate Alice's quadrature, which is restricted by 
the direct reconciliation schemes 12] 

After Alice announces her paring information. Eve can 
only know that Alice's sent state is equivalent to |ao) or 
|ao +6a), where |ao) describes Alice's certain sent state. 
After Bob publics his grouping information. Eve knows 
the channel properties between Alice and Bob, but her 
estimates of Bob's result are still based on her estimates 
of Alice's quadrature. To Eve, the probability of Bob's 
assignment results is P{b — > l|c) = P{\ao + Sa)\c)P{b — > 
l||ao + Sa)) + P{\ao)\c)P{b l||ao)), where b 1 cor- 
respond to Bob assigning his data as 1 and P{\ao)\c) de- 
scribes the probability that Alice has sent |ao) while Eve's 
result is c. min[P(6 — l|c), P{b 0|c)] actually denotes 
Eve's BER. It shows that after the assignment the binary 
channel is a binary Markov chain of Bob — > Alice —> Eve. 
If Eve cannot estimate Alice's result correctly, she cannot 
estimate Bob's correctly. The final amount of practical 
secret keys can be given by 

AI = nY,P{G)[lBG{A:B)^lBG{E:B)] (7) 

G 

where n denotes the number of raw key elements, 
means summation over the groups, P{G) describes the 
probability of the groups, and Ibg{' '■ ■) denotes the mu- 
tual information of a group after their exposure. We see 
that because of the Markov chain Ibg{A '■ B) > Ibg{E : 
B) is always maintained Through Alice's pairing 

information and Bob's grouping information, the trans- 
mission characteristics of the binary channel between Al- 
ice and Bob can be given. The properties of the channel 
between Eve and Alice are discussed in many direct rec- 
onciliation schemes 12]. Then the maximum information 
tapped by Eve can also be given. 

If Bob sorts those bits of a pair with roughly the 
same BER into one group, for a certain group and pair, 
Ibg{A : B) = Hbg{A) - Ec.onp ^G(6)r[P(0|fe)], where 
Hbg{') denotes the Shannon entropy of the distribution 
of and 1 in a certain group, J^Group denotes sum- 
mation in the group, Pg{') is the distribution within 
the group, depending on Bob's grouping method, and 
r(A) = — Alog2 A — (1 — A)log2(l — A) is the Shannon 
entropy. 

The mutual information of a group between Eve 
and Bob can be given by Ibg[E : B) = Hbg{B) — 
J PG{c)T[P{b —>■ l\c)]dc. The minimmn noise on Alice's 
side in estimating Eve's quadrature is given by reference 
[13: Ne ^ No + = For the minimum Gaus- 

sian noise case, we have the conditional distributions: 

-^(^1") = V2^\ne ^^^^~ '^^aNE ]' "^^^^^ " ^ param- 
eter which do not affect the final results. Then by the 
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FIG. 2: Simulation results for secret key rate versus transmis- 
sion line distance. Dashed line: theoretical key rate from Ref. 
iOl; solid line: practical key rate from our simulation result 
using the above method; dotted line: efficiency defined as the 
ratio of the practical to the theoretical key rates 

grouping information, Pg{c), P{\ao)\c) and consequently 
Ibg[E : B) can be obtained. The concrete calculation 
is complex and depending on Bob's grouping method. 
Here, we only give the simulation results. 

The simulation results of the binary secret key rate 
as a function of the channel transmission distance are 
shown in Fig|21 where we have set 5a = {1 + Q.Q2L)\/Ne, 
Va — 500 and the width of the region 5a /I and L is 
the transmission distance in the unit of km. The pairing 
method is that shown in Figm and the bits of both Alice 
and Bob are sorted into groups with roughly the same 
BER, while those bits with too high a BER, higher than 
40%, are discarded. In the simulation we see that the 
maximum efficiency, defined as the ratio of the practical 
to the theoretical secret key rates, is about 37%. At 
the distance of 100km, the efficiency is 18%, the BER 
between Alice and Eve is higher than 4% and the secret 
information per final bit carries is approximately equal 
that per key element carries. Even for long distances 
approaching 150km the efhciency is about 0.15%. While 
in Ref. 0, they distilled the key only within B.ldB loss 
(15km fiber). For long distances the BER between Alice 
and Bob is increased, so many bits should be discarded 
to reduce the computational complexity, at the cost of 
lower efficiency. 

When the channel has excess noise ^A^O: we have 
= (l + G'^)Ao iil, where V.y denotes the conditional 
variance, so H{B\A) = Ho + 0.5 log2(l + = Ho + H'. 
Under this condition through entropy estimation Alice 
and Bob may not be able to find a lurking Eve when 
H{B\A,c) > H{B\A) - 2H', and then the secret key 
rate becomes AI = I{A : B\E) - 2H' . Obviously, this 
case is not always a Markov chain. In this situation 
Eve can do entangling doner attack, using a noiseless 
line to replace the noise one between Alice and Bob and 
injecting an entangled beam into the line to tap more 
of Bob's information 6]. However, under this case, the 
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maximum variance change caused by the entangled beam 
cannot exceed that of the excess noise, so the maxi- 
mum additional information Eve can attack is ladd = 
0.51og2[VBM/min(Kac™m)] = 0.51og2(Fj|^/iV2) ^ 
2H' bits where miii{Vyacuum) denotes the mini- 

mum variance of vacuum noise. Moreover, previous anal- 
yses show that I{A : B\E) is only determined by the 
Markov chain. Thus, this process is equivalent to that 
besides through the previous Markov chain Eve can ob- 
tain additional information of 2H' bits from Bob. It can 
be proved that the exactly same result in reference fill can 
be derived by this way. Therefore, at first Alice and Bob 
can suppose the channel is still a Markov chain, and es- 
timate the maximum information tapped by Eve. If the 
results satisfy A/ > 2H', Alice and Bob can still distill 
a secret key, but the final amount should be subtracted 
by 2nH' bits. Then the amount of secret keys becomes: 
A/ = n{j:cPiG)[lBG{A : B) - Ibg{E : B)] - 2H'}. 

What should be noticed is that if there is excess noise, 
the conditional distribution of Bob and Eve's measure- 
ments will all be changed correspondingly. The A^^; will 
become A^o + ^o/C^+O [13 • ^ the efficiency is 100%, 
only when ^ < 0.5, can the secret key be distilled @|. If 
the reconciliation efficiency is 7, it requires ^ < O.57, 
which can be improved by choose proper post-selection. 

In this protocol, after Alice and Bob's exposure, the as- 
signment process is equivalent to binary modulation, but 
Eve's attack is still limited by CVQKD. To reduce the 
computational complexity, we should concentrate the se- 
cret information into certain bits and increase the differ- 
ence between Eve's minimum BER and Alice's BER [loj . 
In this protocol we see that if there is no excess noise the 
channel is a Markov chain, so if the BER between Alice 
and Eve is maintained nonzero, then the BER between 
Eve and Bob is certainly larger than that between Alice 
and Bob Alice and Bob can use post-selection, dis- 
carding those bits with a high BER between them. Then 
the BER of remained bits between Eve and Bob will be 
sufficiently larger than that between Alice and Bob, so 
the complexity of the error correction can be significantly 
reduced ^3 • For example, if the BER between Alice and 
Bob of remained bits is below 15%, while that between 
Eve and Alice is maintained to be 25%, then the differ- 
ence between the BER between Eve and Bob and that 
between Alice and Bob is larger than 17%. In addition, 
to reduce the computational complexity and increase the 
secret key rate we should choose an appropriate value for 
6a, since 5a affects both the BER between Alice and Bob 
and that between Alice and Eve. We slice Alice's raw key 
element space into very small regions, mainly because by 
doing so Alice and Bob can estimate their BERs exactly. 
Moreover, Bob should sort his binary strings into dif- 
ferent groups according to the BERs, because the bits 
with different BERs may contribute different amounts of 



secret key, and require different error corrections. 

In this letter, we show that under the condition of no 
excess noise Eve's attack is based on a Markov chain in 
the reverse reconciliation CVQKD scheme, and the excess 
noise will only cause additional information loss, which 
can be easily subtracted in the final result. Then we 
propose a secure single-bit-reverse-reconciliation proto- 
col, with low computational complexity. The numerical 
simulation results show that almost 18% of the theoret- 
ical maximum secret information can be distilled by the 
protocol with low computational complexity even when 
the transmission fiber is longer than 100km. 
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